Attackers Hijack Three Country TLDs to Forge Google Certificates
October 8, 2026
Google says attackers compromised the .gh, .sl and .as registries, altered DNS records and obtained fraudulent HTTPS certificates for Google
Cybersecurity
Attackers Hijack Three Country TLDs to Forge Google Certificates
Google says attackers compromised the .gh, .sl and .as registries, altered DNS records and obtained fraudulent HTTPS certificates for Google and other domains.
SonicWall Patches CVSS 10.0 Pre-Auth SSRF in SMA1000 Appliances
SonicWall fixed four SMA1000 flaws, led by CVE-2026-102255, a CVSS 10.0 unauthenticated SSRF in the WorkPlace portal. No exploitation has been reported.
Unpatched LMCache Flaw Allows Unauthenticated Remote Code Execution
JFrog disclosed CVE-2026-105192, a CVSS 9.8 pickle deserialization flaw in LMCache that lets one network message run code. No patched version exists yet.
PoeLLM Malware Hides C2 Addresses in GitHub Poems, Infects 3,000+
Lumen's Black Lotus Labs says PoeLLM malware infected over 3,000 servers, hiding C2 addresses in poems on GitHub to mine cryptocurrency on AI infrastructure.
FBI, Secret Service: FortiBleed Attackers Lock Victims Out of Fortinet
An FBI and Secret Service advisory says a Russian initial access broker is using stolen credentials to lock organizations out of Fortinet FortiGate devices.
Tensorlake npm Package Compromised to Spread Shai-Hulud Worm
Socket and StepSecurity say tensorlake npm version 0.5.144 carried the Shai-Hulud worm, which steals tokens and keys and punishes revoked GitHub tokens.
MonsterCloud Owner Charged With Secretly Paying Ransoms, $19M Billed
Federal prosecutors charged MonsterCloud owner Zohar Pinhasi with wire fraud, alleging he billed victims over $19 million while secretly paying ransom gangs.
US Offers $10 Million for Tips on Zhang Yu, Charged in HAFNIUM Hacks
The State Department's Rewards for Justice program offers up to $10 million for information on Zhang Yu, a Chinese national indicted over the HAFNIUM hacks.
Georgia Power, Alabama Power Portal Breach Hits 400,000 Accounts
An unauthorized party accessed the Georgia Power and Alabama Power customer portal, exposing about 400,000 accounts, including partial SSNs and contact data.
Chrome 155 Patches 247 Vulnerabilities, Including Four Critical
Google released Chrome 155 with fixes for 247 vulnerabilities, four of them critical use-after-free flaws. Google reports no in-the-wild exploitation.
SonicWall Patches CVSS 10.0 Pre-Auth SSRF in SMA1000 Appliances
October 8, 2026
SonicWall fixed four SMA1000 flaws, led by CVE-2026-102255, a CVSS 10.0 unauthenticated SSRF in the WorkPlace portal. No exploitation has
Unpatched LMCache Flaw Allows Unauthenticated Remote Code Execution
October 8, 2026
JFrog disclosed CVE-2026-105192, a CVSS 9.8 pickle deserialization flaw in LMCache that lets one network message run code. No patched
PoeLLM Malware Hides C2 Addresses in GitHub Poems, Infects 3,000+
October 8, 2026
Lumen’s Black Lotus Labs says PoeLLM malware infected over 3,000 servers, hiding C2 addresses in poems on GitHub to mine
FBI, Secret Service: FortiBleed Attackers Lock Victims Out of Fortinet
October 8, 2026
An FBI and Secret Service advisory says a Russian initial access broker is using stolen credentials to lock organizations out
Tensorlake npm Package Compromised to Spread Shai-Hulud Worm
October 8, 2026
Socket and StepSecurity say tensorlake npm version 0.5.144 carried the Shai-Hulud worm, which steals tokens and keys and punishes revoked
MonsterCloud Owner Charged With Secretly Paying Ransoms, $19M Billed
October 8, 2026
Federal prosecutors charged MonsterCloud owner Zohar Pinhasi with wire fraud, alleging he billed victims over $19 million while secretly paying
US Offers $10 Million for Tips on Zhang Yu, Charged in HAFNIUM Hacks
October 8, 2026
The State Department’s Rewards for Justice program offers up to $10 million for information on Zhang Yu, a Chinese national
Georgia Power, Alabama Power Portal Breach Hits 400,000 Accounts
October 8, 2026
An unauthorized party accessed the Georgia Power and Alabama Power customer portal, exposing about 400,000 accounts, including partial SSNs and
Chrome 155 Patches 247 Vulnerabilities, Including Four Critical
October 8, 2026
Google released Chrome 155 with fixes for 247 vulnerabilities, four of them critical use-after-free flaws. Google reports no in-the-wild exploitation.
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.